| From 1770da18ee4b0347071526c645b1be10d089c857 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 26 May 2020 00:39:21 +0000 |
| Subject: ALSA: hwdep: fix a left shifting 1 by 31 UB bug |
| |
| From: Changming Liu <liu.changm@northeastern.edu> |
| |
| [ Upstream commit fb8cd6481ffd126f35e9e146a0dcf0c4e8899f2e ] |
| |
| The "info.index" variable can be 31 in "1 << info.index". |
| This might trigger an undefined behavior since 1 is signed. |
| |
| Fix this by casting 1 to 1u just to be sure "1u << 31" is defined. |
| |
| Signed-off-by: Changming Liu <liu.changm@northeastern.edu> |
| Cc: <stable@vger.kernel.org> |
| Link: https://lore.kernel.org/r/BL0PR06MB4548170B842CB055C9AF695DE5B00@BL0PR06MB4548.namprd06.prod.outlook.com |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| sound/core/hwdep.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c |
| index a73baa1242be..727219f40201 100644 |
| --- a/sound/core/hwdep.c |
| +++ b/sound/core/hwdep.c |
| @@ -229,14 +229,14 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw, |
| if (copy_from_user(&info, _info, sizeof(info))) |
| return -EFAULT; |
| /* check whether the dsp was already loaded */ |
| - if (hw->dsp_loaded & (1 << info.index)) |
| + if (hw->dsp_loaded & (1u << info.index)) |
| return -EBUSY; |
| if (!access_ok(VERIFY_READ, info.image, info.length)) |
| return -EFAULT; |
| err = hw->ops.dsp_load(hw, &info); |
| if (err < 0) |
| return err; |
| - hw->dsp_loaded |= (1 << info.index); |
| + hw->dsp_loaded |= (1u << info.index); |
| return 0; |
| } |
| |
| -- |
| 2.25.1 |
| |